CVE-2022-49209: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49209 affects the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the sockmap functionality. The vulnerability was discovered in the tcp_bpf_sendmsg function where a memory leak occurs when the socket message (sk_msg) is full. When sk_msg_alloc() returns -ENOMEM error and tcp_bpf_sendmsg() goes to wait_for_memory, if partial memory has been allocated by sk_msg_alloc(), a memory leak occurs when msg_tx->sg.size is greater than osize after sk_msg_alloc() (Kernel Git).

The vulnerability exists in the sk_msg_alloc() function where memory allocation for socket messages is handled. When the socket message buffer is full and memory allocation fails with -ENOMEM, the code path fails to properly clean up partially allocated memory before going into wait_for_memory state. This issue affects other call paths of sk_msg_alloc() as well, such as tls_sw_sendmsg(). The fix involves using sk_msg_trim() to release the allocated memory before going to wait for memory state (Kernel Git).

The memory leak can lead to resource exhaustion over time, potentially affecting system stability and performance. The issue manifests through kernel warnings and can be triggered during socket operations, particularly when the system is under memory pressure (Kernel Git).

The vulnerability can be triggered during normal operation of BPF sockmap functionality when the system is under memory pressure. It requires the ability to interact with the kernel's networking stack using BPF programs. The issue has been observed in real-world scenarios, as evidenced by kernel warnings and stack traces (Kernel Git).

The issue has been fixed in the Linux kernel by adding proper memory cleanup using sk_msg_trim() in the sk_msg_alloc() function. The fix ensures that any partially allocated memory is properly released before entering the wait_for_memory state. Users should update to a patched kernel version that includes the fix (Kernel Git).